CikaBika Bot (Malware): news timeline & CVEs

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.

The Hacker News ThreatsDay roundup says ransomware groups Qilin and Settra are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Infoblox describes the Noir cryptocurrency drainer, which uses DNS TXT queries over public DNS-over-HTTPS to find a Cloudflare Pages pool and steal funds after wallet permissions are granted. Separate reports cover CikaBika Bot, KGB RAT, and BotHelper RAT, a multi-stage .NET tool with live screen surveillance. Google also announced broader Android scam detection, including Gemini Nano link checks.

The Hacker NewsOct 15, 18:49 UTC · 1d agoExploit / PoC in the wildCVE-2026-02572· 1 read

CikaBika Bot RAT Uses Discord for C&C

Darktrace reports CikaBika, a Rust RAT using Discord for C2, delivered by phishing PDFs and LNK loaders.

Darktrace reports a campaign distributing CikaBika Bot, a Rust remote-access trojan that uses Discord for command and control. Victims receive a PDF containing a disk image and a Windows LNK disguised as a Word document; opening it shows a decoy and runs hidden PowerShell. A Nim loader writes a Rust DLL and deployment script, attempts to place the DLL in the Edge directory to bypass UAC, and likely sideloads it through DLL search-order hijacking. The RAT collects system, process, and network data plus screenshots, accepts execution and file commands over Discord, and can zip directories for exfiltration through Ngrok.

SecurityWeekOct 15, 11:25 UTC · 1d agoMalware in the wild1

CikaBika Bot

Timeline2 articles

Related CVEsby mentions

Appears with

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

CikaBika Bot RAT Uses Discord for C&C